What is OneWaySFTP?

One-way Transport of System Event Logs via SFTP.

The idea is borrowed from data-diode. We upload (write-only) rotated log files to a specially configured SFTP server to:

Deny SSH/SCP access, only SFTP. No special software required, just openssh-server.
Deny read or directory listing to the /var/sftp/uploads with BindFS; write-only access
Detect SSH/SCP failed attempts by logging a chroot environment. Any of such attempts are reliable indicator of Privilege-Escalation because the credential/private-key can only be read by a non-interactive account with the SFTP script. You can think of it as a trap.
Deter any over-writing attempt by using unix integer timestamp in the rotated file names at the sender-side.
Deter from accessing SSH/SCP now that I revealed that it is a trap ;)

This approach is used together with another project: Sysmon Visualization.

Comparison

	OneWaySFTP	Syslog	Windows Event Forward
Access Control	Yes	NO	Using 'enterprise' PKI can be complex
Complexity/Effort	Low	Low	High & only for Windows
MiTM Detection	Yes	NO	Yes. Hey it's PKI!
Intrusion Detection	Yes	NO	NO
Encrypted Transport	Yes	NO	Depends (some use plain HTTP)
"Cloud/Data-Lake" friendly	Yes	NO	Depends. Usually within Intranet.
Cost	Free	Depends	Skill-set for PKI, AD... etc is not free

If you are using Syslog, please at least enforce network access control, otherwise anyone can spam it with rubbish.

oneWaySFTPsetup.sh was tested with Ubuntu 17.10 but can be adapted to your preferred Linux. A quick outline of what it is doing:

First block of commands are related to creating uploader account & directory permission
Second block is related to setting up "chrooted" SFTP only access by reconfiguring /etc/ssh/sshd_config
Third block enables Rsyslog logging into /var/log/sftp.log within a chrooted directory.
Final block downloads stable Bindfs version that includes --delete-deny, the one in Ubuntu repo may not have that option. The magic of write-only is implemented with BindFS.